Title: FORENSIC PROFILING IN ITS CONTEXT

Forensic profiling in its context

Linkage blindness and limits of profiling

It may be perceived that the necessary data for forensic profiling is immediately available in a suitable form to the criminal justice system. This is definitely not so. Methods for processing data carefully distinguish a selective collection of traces, the collation of the data coming from different sources, the evaluation of its quality, the analysis of the available information and the timely dissemination of intelligence or knowledge on a need to know and right to know basis . This decomposition helps to explicit a series of pervasive difficulties when profiling is envisaged.  

A broad variety of barriers that go far beyond the inadequate use of technologies  hamper the fluidity of information. These can lead to a well identified weakness called linkage blindness , an obstacle to the detection of relevant patterns in the information which exist in reality. This incapacity to connect the dots is generally accepted to be at the origin of main intelligence failures . Below are some examples of causes, but other legal, organisational, methodological, technological, human and fundamental (complexity) causes may also lead to linkage blindness:

1. Law enforcement data is scattered into different files and in different jurisdictions. For instance DNA and Automatic Fingerprint Identification Systems (AFIS) may be centralised at country level, but both databases are generally treated separately as the result of legal rules. Moreover, databases may also use different classification systems and even preclude extractions of parts of the data, as well as electronic exchanges;  

2. Beyond police recorded data, administrative data and openly accessible sources, information is generally not directly accessible and available. If we suppose a specific situation, a judicial authority must intervene to authorise the access by the police and to order the possessor to grant access. This may dramatically slow down the whole process. Consequently, this may invalidate the analysis of the data in function of the dynamics of the problem under scrutiny. For example, several months are sometimes needed for obtaining some set of data in the framework of international cooperation agreements;  

3. Data comes from multiple sources under a broad variety of forms, which can still occasionally be a paper form. Moreover, the whole data treated, even police recorded data, is not prepared for profiling purposes, rather, it is structured for strictly administrative purposes;  

4. Profiles are hypotheses that are based mainly on imperfect (incomplete and uncertain) information. Thus, profiles may provide irrelevant leads and recovering from wrong investigative directions must be possible through recording assessment of the solidity of the information upon which hypotheses have been drawn. 

These difficulties are obstacles to the treatment of data. Whether or not data mining technologies are implemented is not an essential question here. Rather, it appears that collection of data, evaluation of the information and the pre-processing stages for collating different sources of information generally imply a significant effort that must absolutely precede analysis and profiling.  

This is particularly evident when dealing with the more fundamental questions of devising models in order to collate data coming from scattered sources. This data is generally available in different formats and must be structured in a suitable form for analysis purposes. Generally, at least three main dimensions of analysis appear relevant when dealing with criminal data for analysis purposes: what are the entities (for instance objects, individual, groups, traces, series, incidents, etc.) and their relations (for instance this person own this car), chronologies (for instance sequence of transactions between bank accounts), and spatio/temporal developments (for instance concentration of activities and their evolutions). It is very doubtful that data mining would be possible without first engaging efforts to collate the data. This is done through models that are based on at least one of those dimensions, depending on what the problem at hand is and what is searched for in the data.  

Finally, disseminating obtained results in order to make intelligence products available to an organisation is a critical aspect of the whole methodology. The quality of communication influences the possibility to appropriately use the obtained profiles in the field. The analytical part that entices profiling, at the core of the process, must be thus carefully considered within a broader process.  

Data available

Roughly speaking, sets of data available to law enforcement agencies are divided into two categories:  

1. Nominal data directly designates persons or objects (recidivists, intelligence files and suspect files, stolen vehicles or objects, etc.) and their relations. Nominal data may also be obtained in the framework of specific investigations, for instance a list of calls made with a mobile phone (card and/or phone) that cover a certain period of time, a list of people corresponding to a certain profile, or data obtained through surveillances; 

2. Crime data consist of traces that result from criminal activities: physical traces, other information collected at the scene, from witness or victims or some electronic traces, as well as reconstructed descriptions of cases (modus operandi, time intervals, duration and place) and their relations (links between cases, series).

Nominal data and relations may be abstracted in order to describe the structure of groups of offenders or criminal organisations.  

Crime data are ideally also regrouped into abstract descriptions according to recurrent situations that share typical mechanisms. For instance, credit card frauds may be distributed into classes that separate skimming, distraction thefts, other thefts, etc. However, most of the time, data is initially administratively classified according to legal definitions which may mask the real dynamic behind crime problems . This emphasises the necessity to make a distinction between sources of traces (persons or objects), the activity or situation that may explain the traces (the dynamic of the crime: context, immediate environment, victims, offenders) and the offence (legal definition) .  

This separation through crime/criminal data has led to a distinction between the fields of crime analysis, mostly carried out at a regional or local level, and criminal intelligence analysis, mostly the province of central agencies. This duality usually designates two professional communities . However, both are obviously linked under many forms, particularly because traces directly result from behaviours of individuals and help provide some kind of description. This is compound by the aim of the investigation to identify, localise, and then provide evidence about the link between a trace and a person, to assume an activity or help determine an offence. In this context, forensic profiling will constitute the process that focuses on the exploitation of traces, but may overlap with criminal intelligence analysis.